full-disclosure - New Security News Website

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2147483647.1076963660@[192.168.2.101]>
From: pauls at utdallas.edu (Paul Schmehl)
Subject: New Security News Website

--On Monday, February 16, 2004 6:21 PM -0800 g0d <g0d@...laydoh.org> wrote:
>
> on a host running a production website common sense would dictate that
> *any* non-essential services be turned off, if for no other reason then
> the fact that having multiple services running makes the host a prime
> target for attacks. i should think this is even more true when the host
> is running a website that has been advertised on a mailing list which
> attracts the specific element of computing society with a bent towards
> system compromise. while having a test box out there 'in the wild'
> accumulating data on currently-employed techniques for cracking hosts,
> methinks that functionality would be better suited to a separate host.
>
That's certainly the conventional wisdom.  All I'm saying is that one 
should not assume that open ports == insecure.  Sometimes it doesn't mean 
that at all.  If one takes everything they find on the Internet at face 
value, one will often be mistaken.

I suspect that you would agree that there's nothing wrong with running 
multiple services on a "production" box if one has made that decision 
consciously and intelligently?  If so, why assume that the OP has *not* 
done that?  I've already shown evidence that not all the ports are as open 
as they first appear.  Without knowledge of the box, why assume that the OP 
has insecurely configured the host?

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu